fix(web-app-n8n): complete tor service onboarding + resolve subnet collision

n8n was merged (from main) serving a canonical domain without a tor service block, and its local subnet 192.168.106.16/28 collided with svc-net-tor. Declare the complete tor block (meta/services.yml with the playwright-service-flag nocheck, meta/variants.yml pinning services.tor.enabled true in variant 0 and false in the no-auth variant) and move svc-net-tor's nominal (host-networked) subnet to 192.168.106.32/28. Fixes the tor-contract, variant-coverage, bond-baseline, playwright-env and subnet-overlap/duplicate test failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

roles/svc-net-tor/meta/server.yml

@@ -4,4 +4,4 @@
 # test_compose_roles_have_local_network). Kept minimal; not used at runtime.
 networks:
   local:
-    subnet: 192.168.106.16/28
+    subnet: 192.168.106.32/28

roles/web-app-n8n/meta/services.yml

@@ -41,6 +41,11 @@ postgres:
   bond: 1
   enabled: true
   shared: "{{ 'svc-db-postgres' in group_names }}"
+# nocheck: playwright-service-flag
+tor:
+  bond: 1
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
 n8n:
   backup:
     no_stop_required: false

roles/web-app-n8n/meta/variants.yml

@@ -27,6 +27,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 # V2: no auth — everything false, postgres standalone
 - services:
@@ -53,3 +55,6 @@
     prometheus:
       enabled: false
       shared: false
+    tor:
+      enabled: false
+      shared: false  # nocheck: variants-static-override